Which HTTP response header is used to prevent browsers from interpreting files as something other than their declared MIME type?

X-Content-Type-Options: nosniff

A web application uses a load balancer that terminates TLS and forwards HTTP to the backend. The application team wants to ensure that all client communication is encrypted. Which configuration change should you recommend?

Set the Secure flag on all cookies issued by the application.

Enable HTTP Strict Transport Security (HSTS) on the load balancer with a max-age of at least six months.

Disable TLS 1.0 and TLS 1.1 on the load balancer.

Configure the backend server to redirect all HTTP requests to HTTPS.

During a configuration test, you find that the web server exposes its version number in the Server header and that error pages include the full file system path. In the report, how should these findings be categorized?

High severity – requires emergency change

Not a finding – these are default behaviors

Information disclosure – low to medium severity, with remediation to remove version banners and sanitize error pages

Critical severity – immediate patch required

A web server is configured with a default installation page and has WebDAV enabled. An unauthenticated user can PUT a file to the server. What is the most likely risk and the best immediate remediation?

The attacker can brute-force credentials; enable account lockout

The attacker can upload malicious content and potentially execute it; disable WebDAV and remove the default page

The attacker can read the default page; change the default page

The attacker can perform a denial of service; rate-limit requests

GIAC Web Application Penetration Tester

Domain 3Objective 1

Web Application Configuration Testing GWAPT Practice Questions (Page 6)

Part of the Configuration and Deployment Testing domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 9–16 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 26–30

26foundation · easy
Which HTTP response header is used to prevent browsers from interpreting files as something other than their declared MIME type?
Select an answer first
27application · medium
A web application uses a load balancer that terminates TLS and forwards HTTP to the backend. The application team wants to ensure that all client communication is encrypted. Which configuration change should you recommend?
Select an answer first
28foundation · easy
Which of the following is an example of an insecure default configuration in a web server?
Select an answer first
29application · medium
During a configuration test, you find that the web server exposes its version number in the Server header and that error pages include the full file system path. In the report, how should these findings be categorized?
Select an answer first
30application · medium
A web server is configured with a default installation page and has WebDAV enabled. An unauthenticated user can PUT a file to the server. What is the most likely risk and the best immediate remediation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.